From 74ee73da01d0c49ba0cecd8ad9e6d0c19c160599 Mon Sep 17 00:00:00 2001 From: librelad Date: Wed, 19 Aug 2026 03:56:42 +0100 Subject: [PATCH] config: default Rocket.Chat and Stoat to automatic updates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The only two templates in the catalogue shipping UPDATE_TYPE=manual, and both rationales turn out not to apply to what auto actually does. Automatic updates act on update_available, which is digest-based: they apply a REBUILD of the tag an app already tracks and never cross a version line. Crossing lines is the stepped Upgrade, which is a deliberate action and stays one. So Rocket.Chat, pinned to 8.7.0 with mongo 8.0, cannot be walked across a major by the automatic path — the failure its comment guarded against was unreachable. And Stoat's nine stoatchat services are all pinned to the same tag, so a pull moves them together or not at all; they cannot "roll forward independently" into an API/events mismatch. What manual did cost was real: neither app picked up security rebuilds of the version it was already on. Rocket.Chat is carrying a critical CVE at the time of this change. Co-Authored-By: Claude Opus 5 --- containers/rocketchat/rocketchat.config | 12 ++++++++---- containers/stoat/stoat.config | 13 ++++++++----- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/containers/rocketchat/rocketchat.config b/containers/rocketchat/rocketchat.config index 8a8d885..b3d17f5 100644 --- a/containers/rocketchat/rocketchat.config +++ b/containers/rocketchat/rocketchat.config @@ -14,10 +14,14 @@ CFG_ROCKETCHAT_APP_NAME=rocketchat CFG_ROCKETCHAT_BACKUP=true CFG_ROCKETCHAT_BACKUP_STRATEGY=auto -# Manual, not auto. Rocket.Chat runs schema migrations on boot and refuses to -# start if the image is more than one major behind the database — an unattended -# jump across majors can leave the instance down until someone intervenes. -CFG_ROCKETCHAT_UPDATE_TYPE=manual +# Auto. Rocket.Chat does run schema migrations on boot and does refuse to start +# too far behind its database — but an automatic update cannot put it there. +# Auto only ever applies a REBUILD of the tag already tracked (8.7.0, mongo 8.0); +# crossing a version line is the stepped Upgrade, which stays a deliberate act. +# So the majors-jump this once guarded against is not reachable from here, while +# staying manual meant the app never picked up security rebuilds of its own +# version — the thing auto exists for. +CFG_ROCKETCHAT_UPDATE_TYPE=auto CFG_ROCKETCHAT_COMPOSE_FILE=default CFG_ROCKETCHAT_HEALTHCHECK=true # Rocket.Chat's own accounts back its mobile and desktop clients; forward-auth diff --git a/containers/stoat/stoat.config b/containers/stoat/stoat.config index 3082eb5..3b65d4b 100644 --- a/containers/stoat/stoat.config +++ b/containers/stoat/stoat.config @@ -23,11 +23,14 @@ CFG_STOAT_APP_NAME=stoat CFG_STOAT_REQUIRES="" CFG_STOAT_BACKUP=true CFG_STOAT_BACKUP_STRATEGY=auto -# Manual, deliberately. This is a sixteen-service stack whose components are -# released together and expect matching versions; letting them roll forward -# unattended and independently is how you end up with an API talking to an -# incompatible events service. -CFG_STOAT_UPDATE_TYPE=manual +# Auto. The components of this stack are released together and do expect +# matching versions — which is exactly why they are all pinned to the same tag +# (api, events, file-server, proxy, gifbox, crond, pushd, voice-ingress all on +# one STOAT_*_VERSION_TAG). An automatic update pulls rebuilds of those pinned +# tags, so the services move together or not at all; they cannot drift apart on +# their own. Moving the stack to a new release line is the stepped Upgrade and +# remains a deliberate act. +CFG_STOAT_UPDATE_TYPE=auto CFG_STOAT_COMPOSE_FILE=default CFG_STOAT_HEALTHCHECK=true # Stoat's own accounts back its clients, and /api must stay reachable without a